Communications & Media Security Policy

Document Number: ISMS-POL-COM-01

Classification: L1 — Policy (Domain)

Version: 0.1.2

Effective Date: March 1, 2026

Author: Lucas Shin — Security Director

Approved By: Richard — CISO

Next Review Date: February 2027

Parent Policy: Information Security Policy (ISMS-POL-ISP-01)

1. Purpose

This policy defines the security requirements for external communications and media production — including YouTube content, e-book publishing, social media presence, and public-facing materials — to prevent inadvertent disclosure of confidential information, protect client data, and maintain Cybercraft brand integrity.

Cybercraft operates in dual capacity as both a security consultancy and a content producer (YouTube, e-books). This creates a unique risk: content intended for public audiences may inadvertently expose internal configurations, client data, or security architecture details.

2. Scope

2.1 Applicable Activities

• YouTube video production — tutorials, demonstrations, security awareness content
• E-book writing and publishing — security guides, technical documentation
• Social media — LinkedIn, Twitter/X, and other platforms used for Cybercraft brand promotion
• Blog posts and articles — published on Cybercraft website or third-party platforms
• Conference presentations and webinars
• Client-facing marketing materials

2.2 Applicable Personnel

• All Cybercraft personnel involved in content creation or public communications
• Contractors producing content on behalf of Cybercraft

2.3 Out of Scope

• Internal communications (email, Teams chat) — covered by M365 Workspace & Access Policy (ISMS-POL-M365-01)
• Personal social media accounts (unless representing Cybercraft or discussing Cybercraft business)

3. Screen Capture and Recording Controls

3.1 Corporate Data Exposure Risk

Derived from BYOD Security Policy (ISMS-POL-BYOD-01) Section 5.2 and Section 6:

Content production often involves screen recording or screenshots. When corporate applications are visible, there is a risk of exposing:

• Client names and engagement details visible in Teams channels, email, or project tools
• Internal security configurations — Intune policies, CA rules, Entra ID settings
• Personnel information — email addresses, user lists, role assignments
• Financial data — invoices, contracts, billing information

3.2 Technical Controls

Important: On macOS, the ADUE managed volume protects data at rest but does not prevent screen recording. Content creators using macOS must follow the procedural controls in Section 3.3.

3.3 Procedural Controls for Content Production

4. Content Security Review

4.1 Pre-Publication Review

All public-facing content must be reviewed for security risks before publication:

4.2 Review Checklist

Before publishing any content, verify:

5. Public Disclosure Controls

5.1 What May Be Disclosed

• General security best practices and educational content
• Cybercraft's service offerings and capabilities (at a marketing level)
• Industry frameworks and standards (ISO 27001, ACSC Essential Eight) in an educational context
• Anonymised case studies with client consent

5.2 What Must NOT Be Disclosed

• Specific Cybercraft internal security configurations, policies, or architecture details
• Client names, engagement scope, or deliverables without written client consent
• Vulnerability information about Cybercraft or client systems
• Internal communications, meeting notes, or strategic plans
• Personnel salary, contract terms, or personal information
• Any information classified as Confidential under the data classification scheme

5.3 Client Data in Content

• No client data may be used in content production without explicit written consent from the client
• Client consent must specify: what data, in what context, for what audience
• Consent records are maintained by the CEO (Farah) and reviewed annually

6. Brand Protection

6.1 Consistent Representation

• All public-facing content must represent Cybercraft accurately and professionally
• Security claims must be factual and verifiable — do not overstate Cybercraft's certifications or capabilities
• When discussing Cybercraft's ISO 27001 alignment, use precise language: "designed to align with ISO 27001" (not "ISO 27001 certified") unless formal certification has been achieved

6.2 Incident Response for Public Content

If confidential information is inadvertently published:

7. Email-Based Information Transfer Controls

7.1 Scope

This section governs the use of email (Outlook) as a channel for transferring information — particularly Confidential data — to external parties. Internal email communications within the M365 tenant are governed by M365 Workspace & Access Policy (ISMS-POL-M365-01).

7.2 Permitted Use

• General classification data: May be sent to external recipients via Outlook without additional approval
• Internal classification data: May be sent to external recipients when there is a documented business justification
• Confidential classification data: Requires Security Director approval before sending. For ongoing collaboration, use the Teams-based Confidential External Sharing procedure (M365 Workspace Operations Procedure, ISMS-PROC-M365-01 §4) instead of email.

7.3 Controls

7.4 Prohibited

• Sending Confidential data to personal email addresses (e.g., Gmail, Yahoo)
• Auto-forwarding corporate email to external accounts
• Using email as the primary channel for ongoing Confidential data collaboration (use Teams-based procedure instead)

Cross-reference: For the Confidential External Sharing 5-step procedure via Teams, see M365 Workspace Operations Procedure (ISMS-PROC-M365-01) §4. For data classification definitions, see M365 Workspace & Access Policy (ISMS-POL-M365-01) §3.

8. Content Production on BYOD Devices

Derived from BYOD Security Policy (ISMS-POL-BYOD-01) Section 6.1 and 6.2:

When content is produced on personal devices enrolled in BYOD:

• The work domain (managed volume / Work Profile) is logically isolated from the personal domain
• Content production tools (video editors, screen recorders) run in the personal domain and cannot directly access work data
• However, screen recording on macOS can capture work application windows if they are open — this is the primary residual risk
• Content creators must follow the procedural controls in Section 3.3 to mitigate this risk

9. Roles and Responsibilities

10. Compliance Mapping

11. Document Control

Review Schedule

• Quarterly: Content security spot check, review of published content for compliance
• Annually: Full policy review, content production workflow assessment
• Ad-hoc: After content-related security incidents, new content platform adoption, or client consent changes

[End of Policy Document]